feat(installer): verify release assets + switch public docs to standalone entrypoint

CONTRIBUTING.md

@@ -30,7 +30,10 @@ We favor small, atomic PRs that address a single issue or add a single, self-con
 - **Do:** Create a PR that fixes one specific bug or adds one specific feature.
 - **Don't:** Bundle multiple unrelated changes (e.g., a bug fix, a new feature, and a refactor) into a single PR.
 
-Large changes should be broken down into a series of smaller, logical PRs that can be reviewed and merged independently.
+As a rule of thumb, start splitting a PR once it exceeds about 1,200 changed
+lines. PRs above about 2,000 changed lines should either be split into a series
+of smaller, logical PRs that can be reviewed and merged independently, or
+explain in the PR description why the change needs to land together.
 
 #### 3. Use Draft PRs for Work in Progress
 

README.md

@@ -46,15 +46,13 @@ Qwen Code is an open-source AI agent for the terminal, optimized for Qwen series
 #### Linux / macOS
 
 ```bash
-bash -c "$(curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh)"
+curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.sh | bash
 ```
 
-#### Windows (Run as Administrator)
+#### Windows
 
-Works in both Command Prompt and PowerShell:
-
-```cmd
-powershell -Command "Invoke-WebRequest 'https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.bat' -OutFile (Join-Path $env:TEMP 'install-qwen.bat'); & (Join-Path $env:TEMP 'install-qwen.bat')"
+```powershell
+irm https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.ps1 | iex
 ```
 
 > **Note**: It's recommended to restart your terminal after installation to ensure environment variables take effect.

docs/developers/contributing.md

@@ -30,7 +30,10 @@ We favor small, atomic PRs that address a single issue or add a single, self-con
 - **Do:** Create a PR that fixes one specific bug or adds one specific feature.
 - **Don't:** Bundle multiple unrelated changes (e.g., a bug fix, a new feature, and a refactor) into a single PR.
 
-Large changes should be broken down into a series of smaller, logical PRs that can be reviewed and merged independently.
+As a rule of thumb, start splitting a PR once it exceeds about 1,200 changed
+lines. PRs above about 2,000 changed lines should either be split into a series
+of smaller, logical PRs that can be reviewed and merged independently, or
+explain in the PR description why the change needs to land together.
 
 #### 3. Use Draft PRs for Work in Progress
 

docs/users/overview.md

@@ -10,19 +10,19 @@
 ### Install Qwen Code:
 
 The recommended installer uses a standalone archive when one is available for
-your platform. If it falls back to npm, Node.js 20 or later with npm must be
+your platform. If it falls back to npm, Node.js 22 or later with npm must be
 available on PATH.
 
 **Linux / macOS**
 
 ```sh
-curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh | bash
+curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.sh | bash
 ```
 
 **Windows**
 
-```cmd
-powershell -Command "Invoke-WebRequest 'https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.bat' -OutFile (Join-Path $env:TEMP 'install-qwen.bat'); & (Join-Path $env:TEMP 'install-qwen.bat')"
+```powershell
+irm https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.ps1 | iex
 ```
 
 > [!note]

docs/users/quickstart.md

@@ -21,13 +21,13 @@ To install Qwen Code, use one of the following methods:
 **Linux / macOS**
 
 ```sh
-curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.sh | bash
+curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.sh | bash
 ```
 
-**Windows (Run as Administrator)**
+**Windows**
 
-```cmd
-powershell -Command "Invoke-WebRequest 'https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen.bat' -OutFile (Join-Path $env:TEMP 'install-qwen.bat'); & (Join-Path $env:TEMP 'install-qwen.bat')"
+```powershell
+irm https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.ps1 | iex
 ```
 
 > [!note]

docs/users/support/Uninstall.md

@@ -1,6 +1,6 @@
 # Uninstall
 
-Your uninstall method depends on how you ran the CLI. Follow the instructions for either npx or a global npm installation.
+Your uninstall method depends on how you installed the CLI.
 
 ## Method 1: Using npx
 
@@ -40,3 +40,21 @@ npm uninstall -g @qwen-code/qwen-code
 ```
 
 This command completely removes the package from your system.
+
+## Method 3: Standalone Install
+
+If you installed via the standalone installer (`curl ... | bash` or `irm ... | iex`), use the dedicated uninstall script.
+
+**Linux / macOS**
+
+```bash
+curl -fsSL https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/uninstall-qwen-standalone.sh | bash
+```
+
+**Windows**
+
+```powershell
+irm https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/uninstall-qwen-standalone.ps1 | iex
+```
+
+The uninstaller removes the standalone runtime, generated `qwen` wrapper, and installer-managed PATH changes. Your Qwen Code configuration (`~/.qwen`) is preserved by default.

scripts/create-standalone-package.js

@@ -608,4 +608,4 @@ function fail(message) {
   throw new Error(`Error: ${message}`);
 }
 
-export { writeSha256Sums };
+export { TARGETS, writeSha256Sums };

scripts/installation/INSTALLATION_GUIDE.md

@@ -46,11 +46,6 @@ standalone release. The `standalone` suffix intentionally avoids overwriting the
 existing production `install-qwen.sh` / `install-qwen.bat` OSS objects during
 the staged rollout.
 
-Public installation documentation intentionally continues to use the existing
-production installer in this PR. Update README and other public quick-install
-instructions in a follow-up after the standalone-suffixed hosted installers and
-release archive sync have been validated in production.
-
 Hosted installer assets are staged separately from GitHub Release archives:
 
 - `install-qwen-standalone.sh` is the Linux/macOS hosted entrypoint.

scripts/installation/install-qwen-standalone.bat

@@ -439,11 +439,10 @@ exit /b 1
 
 :ValidateVersion
 if /i "!VERSION!"=="latest" exit /b 0
-set "QWEN_VERSION_VALUE=!VERSION!"
-powershell -NoProfile -ExecutionPolicy Bypass -Command "$value = $env:QWEN_VERSION_VALUE; if ($value -match '^v?[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9]+)*$') { exit 0 }; exit 1"
-set "PS_STATUS=%ERRORLEVEL%"
-set "QWEN_VERSION_VALUE="
-if %PS_STATUS% EQU 0 exit /b 0
+echo(!VERSION!| findstr /R /C:"^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*[A-Za-z0-9.-]*$" >nul
+if %ERRORLEVEL% EQU 0 exit /b 0
+echo(!VERSION!| findstr /R /C:"^v[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*[A-Za-z0-9.-]*$" >nul
+if %ERRORLEVEL% EQU 0 exit /b 0
 echo ERROR: --version must be 'latest' or a semver string.
 exit /b 1
 
@@ -1050,7 +1049,7 @@ REM with backslash separators even though the ZIP spec requires '/'. We
 REM accept either separator and reject only entries that, after
 REM normalization, are empty, absolute, drive-rooted, or contain a '..'
 REM segment.
-powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'Stop'; $archive = $null; try { Add-Type -AssemblyName System.IO.Compression.FileSystem; $archive = [IO.Compression.ZipFile]::OpenRead($env:QWEN_ARCHIVE_FILE); foreach ($entry in $archive.Entries) { $raw = $entry.FullName; if ($raw.IndexOfAny([char[]](10,13)) -ge 0) { [Console]::Error.WriteLine('Archive contains unsafe path with control character: ' + $raw); exit 1 }; $name = $raw -replace '\\', '/'; while ($name.StartsWith('./')) { $name = $name.Substring(2) }; if ($name -eq '' -or $name.StartsWith('/') -or $name -match '^[A-Za-z]:' -or $name -match '(^|/)\.\.(/|$)') { [Console]::Error.WriteLine('Archive contains unsafe path: ' + $entry.FullName); exit 1 } } } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 2 } finally { if ($null -ne $archive) { $archive.Dispose() } }"
+powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'Stop'; $archive = $null; try { Add-Type -AssemblyName System.IO.Compression.FileSystem; $archive = [IO.Compression.ZipFile]::OpenRead($env:QWEN_ARCHIVE_FILE); if ($archive.Entries.Count -eq 0) { [Console]::Error.WriteLine('Archive is empty: ' + $env:QWEN_ARCHIVE_FILE); exit 3 }; foreach ($entry in $archive.Entries) { $raw = $entry.FullName; if ($raw.IndexOfAny([char[]](10,13)) -ge 0) { [Console]::Error.WriteLine('Archive contains unsafe path with control character: ' + $raw); exit 1 }; $name = $raw -replace '\\', '/'; while ($name.StartsWith('./')) { $name = $name.Substring(2) }; if ($name -eq '' -or $name.StartsWith('/') -or $name -match '^[A-Za-z]:' -or $name -match '(^|/)\.\.(/|$)') { [Console]::Error.WriteLine('Archive contains unsafe path: ' + $entry.FullName); exit 1 } } } catch { [Console]::Error.WriteLine($_.Exception.Message); exit 2 } finally { if ($null -ne $archive) { $archive.Dispose() } }"
 set "PS_STATUS=%ERRORLEVEL%"
 set "QWEN_ARCHIVE_FILE="
 if %PS_STATUS% EQU 0 exit /b 0
@@ -1062,6 +1061,10 @@ if %PS_STATUS% EQU 2 (
     echo ERROR: Archive could not be inspected before extraction.
     exit /b 1
 )
+if %PS_STATUS% EQU 3 (
+    echo ERROR: Archive is empty: !ARCHIVE_FILE!
+    exit /b 1
+)
 echo ERROR: Archive validation failed before extraction.
 exit /b %PS_STATUS%
 

scripts/installation/install-qwen-standalone.sh

@@ -884,6 +884,22 @@ validate_archive_entry_path() {
     esac
 }
 
+archive_contains_symlinks() {
+    local archive_path="$1"
+
+    case "${archive_path}" in
+        *.zip)
+            unzip -Z -v "${archive_path}" 2>/dev/null | grep -E 'Unix file attributes \(12[0-7]{4} octal\)' >/dev/null
+            ;;
+        *.tar.gz|*.tgz|*.tar.xz)
+            tar -tvf "${archive_path}" 2>/dev/null | awk '$1 ~ /^l/ { found=1 } END { exit found ? 0 : 1 }'
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
 validate_archive_contents() {
     local archive_path="$1"
     local entries
@@ -912,6 +928,16 @@ validate_archive_contents() {
             ;;
     esac
 
+    if [[ -z "${entries}" ]]; then
+        log_error "Archive is empty: ${archive_path}"
+        return 1
+    fi
+
+    if archive_contains_symlinks "${archive_path}"; then
+        log_error "Archive contains symlinks; refusing to install."
+        return 1
+    fi
+
     while IFS= read -r entry; do
         validate_archive_entry_path "${entry}" || return 1
     done <<< "${entries}"

scripts/installation/install-qwen-with-source.bat

@@ -306,7 +306,9 @@ exit /b 1
 
 :ValidateVersion
 if /i "!VERSION!"=="latest" exit /b 0
-echo(!VERSION!| findstr /R /C:"^v*[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*[A-Za-z0-9.-]*$" >nul
+echo(!VERSION!| findstr /R /C:"^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*[A-Za-z0-9.-]*$" >nul
+if %ERRORLEVEL% EQU 0 exit /b 0
+echo(!VERSION!| findstr /R /C:"^v[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*[A-Za-z0-9.-]*$" >nul
 if %ERRORLEVEL% EQU 0 exit /b 0
 echo ERROR: --version must be 'latest' or a semver string.
 exit /b 1

scripts/installation/install-qwen-with-source.sh

@@ -624,6 +624,22 @@ validate_archive_entry_path() {
     esac
 }
 
+archive_contains_symlinks() {
+    local archive_path="$1"
+
+    case "${archive_path}" in
+        *.zip)
+            unzip -Z -v "${archive_path}" 2>/dev/null | grep -E 'Unix file attributes \(12[0-7]{4} octal\)' >/dev/null
+            ;;
+        *.tar.gz|*.tgz|*.tar.xz)
+            tar -tvf "${archive_path}" 2>/dev/null | awk '$1 ~ /^l/ { found=1 } END { exit found ? 0 : 1 }'
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
+
 validate_archive_contents() {
     local archive_path="$1"
     local entries
@@ -652,6 +668,16 @@ validate_archive_contents() {
             ;;
     esac
 
+    if [[ -z "${entries}" ]]; then
+        log_error "Archive is empty: ${archive_path}"
+        return 1
+    fi
+
+    if archive_contains_symlinks "${archive_path}"; then
+        log_error "Archive contains symlinks; refusing to install."
+        return 1
+    fi
+
     while IFS= read -r entry; do
         validate_archive_entry_path "${entry}" || return 1
     done <<< "${entries}"